KQL Search

This query is designed to find and list processes on devices that match a set of known malicious file hashes. Here's a breakdown of what it does:

1. Define Malicious Hashes: It starts by creating a list of known bad file hashes (e.g., "hash1", "hash2", "hash3"). You should replace these placeholders with actual malicious hashes based on your threat intelligence.

2. Search for Matching Processes: It searches through the DeviceProcessEvents data to find any processes that have run in the last 7 days (ago(7d) .. now()) and have a SHA1 hash that matches one of the hashes in the badHashes list.

3. Select Relevant Information: For each matching process, it selects and displays specific details: the time the process was observed (Timestamp), the name of the device where it ran (DeviceName), the name of the file (FileName), the SHA1 hash (SHA1), the command line used to start the process (ProcessCommandLine), and the account name that initiated the process (InitiatingProcessAccountName).

4. Sort Results: Finally, it sorts the results by the timestamp in descending order, so the most recent events appear first.

In summary, this query helps you identify and investigate potentially malicious processes on your network by comparing their file hashes against a list of known threats.